https://github.com/osquery/osquery logo
v

vaar

01/13/2021, 11:04 PM
is thre a way to run a single query against yara table with multiple sigfile's?
m

Mike Myers

01/14/2021, 12:20 AM
Yes, that should be possible
f

Faraz Jafri

01/14/2021, 11:31 AM
Have you tried using sig_group instead of sigfile? You can add multiple files collectively in a group and run a query with that sig_group. Though a group has to be defined in osquery.conf file.
☝️ 1
👍 1
5 Views